I harden AWS and EKS in production and map compliance requirements (SOC 2, ISO 27001, CMMC) into policy-as-code enforced in CI/CD. Day to day, in regulated cloud environments: IAM least-privilege, Kubernetes RBAC hardening, detection/triage/response on CrowdStrike Falcon and GuardDuty, and Terraform/Pulumi security controls.

Professional work is under @oliveratprimer — AWS/EKS security automation, CrowdStrike Falcon operations, GuardDuty detection workflows, and SOC 2 / ISO 27001 / CMMC audit readiness. This account is my public portfolio and writing.

• secure-iam-lint — CI-ready linter for AWS IAM policies; flags privilege-escalation paths and wildcard grants before they merge.
• iam-safe-defaults — Pulumi component library for AWS IAM with safe defaults that fail loud: mandatory permissions boundary, no wildcard trust, every opt-out explicit. 📝 Design rationale: IAM Roles That Fail Loud
• eks-rbac-audit — Kubernetes RBAC escalation auditor for EKS (in design) — the K8s counterpart to secure-iam-lint.
• devsecops-notes — Source for rivassec.com: Pelican, with link-check, accessibility (pa11y), and gitleaks CI.
• weaponization-threat-model — One-page addendum to STRIDE/LINDDUN/PASTA for modeling the case where the legitimate operator of the system becomes the adversary.
• cf-token-links — Token-based redirect microservice with expiration and usage limits (Flask).
• elasticsearch-tools — Minimal-privilege Elasticsearch snapshot verification with Prometheus-style metrics.
• efi-bruteforce — Archival research (2013): Teensy-based USB HID brute force of MacBook EFI passwords, featured on Hackaday.

Field notes on IAM, Kubernetes, detection/IR, and security automation. Latest:

• IAM Blast Radius Is an Architecture Problem, Not a Policy Problem
• The Discovery Layer Is Broken: Hiring as an Observability Problem
• Prompt Injection Will Become a Supply Chain Evasion Technique

• Cloud & IaC: AWS (EKS, IAM, Organizations), Pulumi, Terraform, CloudFormation
• Security: IAM/RBAC least privilege, Zero Trust, CIS Benchmarks, FIPS
• Detection & Response: CrowdStrike Falcon, GuardDuty
• Compliance: SOC 2, ISO 27001, CMMC, FedRAMP — policy-as-code pipelines
• Pipeline: GitHub Actions, Trivy, Checkov, Bandit, Vault
• Observability: Prometheus, Grafana
• Languages: Python, Bash (daily) · Go (familiar)

Security is not a feature. It is infrastructure.

All contributions are built for clarity, reproducibility, and operational reliability.